CVE-2025-11738 is a path or filename control vulnerability in the Media Library Assistant plugin for WordPress, specifically in the mla-stream-image.php file. It allows unauthenticated remote attackers to read arbitrary files with extensions ai, eps, pdf, and ps on the server. This vulnerability affects all versions up to and including 3.29. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, resulting in limited confidentiality impact. No known exploits in the wild have been reported. No patch or vendor advisory is currently available.

An unauthenticated attacker can read the contents of certain file types on the affected server, potentially exposing sensitive information contained within those files. The impact is limited to confidentiality loss; integrity and availability are not affected. The vulnerability does not require authentication or user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the mla-stream-image.php file or limiting exposure of affected file types via web server configuration to reduce risk.